[chrismattmann]

Stacked on #502 — based on that branch, so this diff shows only the new change. Merge #502 first.

Two things in parseAndSave, both in the same three lines.

It did not write anything without an outDir

The write sat inside the else:

if outDir is None:
    metaPath = path + metaExtension          # <- and that was all
else:
    metaPath = os.path.join(outDir, ...)
    log.info('Writing %s' % metaPath)
    with open(metaPath, 'w', encoding='utf-8') as f:
        f.write(...)

So parseAndSave(option, paths) computed a path, wrote nothing, and returned the name of a file that did not exist — in a function called parseAndSave, whose docstring says it "write[s] extracted metadata and/or text in JSON format to matching filename".

This is a behaviour change. Callers who passed no outDir previously got no files and will now get <input>_meta.json next to each input, which is what the name and the docstring promise. Say the word if you'd rather I split this out or leave the old behaviour.

A symlink at the output name was written through

The destination name is derived from the input name, so it is predictable, and a link planted at it got written through as whoever runs tika. Same shape as the log and cache files in #502, and it applies to both branches — the no-outDir case writes next to the input, which is just as predictable.

Unlike the cache, this path is deliberately not treated as ours:

• Ownership is not checked. The directory is the caller's to choose and may legitimately be group-writable or shared; refusing that would break ordinary use. The symlink refusal is the part that matters here.
• The mode stays 0o666, so the umask decides, exactly as the plain open() did. These are outputs somebody asked for, not cache files — forcing 0600 would quietly change who can read them.

_openPrivate grows checkOwner, encoding and perm for that distinction, plus a text 'w' mode so the utf-8 encoding the old call specified is preserved.

Tests

tests/test_output_paths.py, 10 cases; suite 68 → 78, all passing. The symlink case was confirmed to fail against the plain open() rather than assumed:

FAILED tests/test_output_paths.py::test_a_symlink_at_the_output_name_is_not_written_through

Also pinned: that the opener's two callers differ the way they're meant to — a cache file lands 0600 and ownership-checked, an output file does not; that the umask still decides output permissions; that an existing output is overwritten rather than appended; and that utf-8 survives.

[coveralls]

Coverage is 72.818% — refuse-a-symlink-where-the-output-goes into verify-the-server-jar-before-running-it. No base build found for verify-the-server-jar-before-running-it.